Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants

published 2025-11-19 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-198221

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to delete arbitrary participants from polls without ownership verification. The endpoint relies solely on a participant ID to authorize deletions, enabling attackers to remove other users (including poll owners) from polls. This impacts the integrity and availability of poll participation data. This issue has been patched in version 4.5.4.

Patch / fix

fixed in 1 links 1

rallly rallly 4.5.4

github.com/lukevella/rallly/releases/tag/v4.5.4 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 11 mo ago (2025-11-19)

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/lukevella/rallly/security/advisories/GHSA-f8jc-6746-ww95 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

lukevella rallly

Classification

Weakness

CWE-285 Improper Authorization
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-862 Missing Authorization

References

github.com /lukevella/rallly/security/advisories/GHSA-f8jc-6746-ww95
exploit, vendor-advisory
github.com /lukevella/rallly/releases/tag/v4.5.4
release-notes

Sources

CVE List CVE-2025-65029
NVD CVE-2025-65029

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary